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ICO consultation on the draft updated data sharing 
code of practice 


Data sharing brings important benefits to organisations and individuals, 
making our lives easier and helping to deliver efficient services. 


It is important, however, that organisations which share personal data 
have high data protection standards, sharing data in ways that are fair, 
transparent and accountable. We also want organisations to be confident 
when dealing with data sharing matters, so individuals can be confident 
their data has been shared securely and responsibly. 


As required by the Data Protection Act 2018, we are working on updating 
our data sharing code of practice, which was published in 2011. We are 
now seeking your views on the draft updated code. 


The draft updated code explains and advises on changes to data 
protection legislation where these changes are relevant to data sharing. It 
addresses many aspects of the new legislation including transparency, 
lawful bases for processing, the new accountability principle and the 
requirement to record processing activities. 


The draft updated code continues to provide practical guidance in relation 
to data sharing and promotes good practice in the sharing of personal 
data. It also seeks to allay common concerns around data sharing. 


As well as legislative changes, the code deals with technical and other 
developments that have had an impact on data sharing since the 
publication of the last code in 2011. 


Before drafting the code, the Information Commissioner launched a call 
for views in August 2018. You can view a summary of the responses and 
some of the individual responses here. 


If you wish to make any comments not covered by the questions in the 
Survey, or you have any general queries about the consultation, please 


email us at datasharingcode@ico.org.uk. 


Please send us your responses by Monday 9 September 2019. 


Privacy Statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
Capacity (e.g. a member of the public). All responses from organisations 
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and individuals responding in a professional capacity will be published. We 
will remove email addresses and telephone numbers from these 
responses; but apart from this, we will publish them in full. 


For more information about what we do with personal data please see our 
privacy notice. 


Questions 


Note: when commenting, please bear in mind that, on the whole, the 
code does not duplicate the content of existing guidance on particular 
data protection issues, but instead encourages the reader to refer to the 
most up to date guidance on the ICO website. 


Qi Does the updated code adequately explain and advise on the new 
aspects of data protection legislation which are relevant to data 
sharing? 


[| Yes 


K No 


Q2 If not, please specify where improvements could be made. 


On the whole the code adequately explains and advises on updated 
aspects of DP legislation. However it is felt that the following sections 
require greater clarity: 


- Page 18: The term ‘data pooling’ has been introduced. Is the ICO 
able to expand on this and provide some examples? It is assumed 
that this is to replace the DPA 1998 term: ‘Data Controllers in 
Common’? Also should controllers be explicitly referring to ‘Data 
Pooling’ in ISAs? 


Page 25: The Code explains that the terms data sharing agreement, 
information sharing agreement, and information sharing protocol are 
interchangeable. Many local areas, like ours, have information 
sharing protocols which are not agreements but instead a set of 
Standards for sharing information locally - would the ICO reconsider 
that a ‘protocol’ and ‘agreement’ are the same? This can often cause 
confusion amongst non-practitioners. 
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- Pages 27 + 28 and 51 + 52: Whilst this group accepts that ISAs 
Should reflect FOI,EIR, and DPA arrangements between Partners we 
believe the Code’s position on having one point of contact for data 
subjects to exercise Data Protection rights is disproportionately 
burdensome. Whilst this would be sensible in a data pooling exercise 
it is impractical for most ISAs. An ISA could involve a number of data 


flows and not all organisations will have access to all of the data. A 
better suggestion would be to provide the data subject with a list of 
which organisations will likely hold what data so that they are able to 
exercise their rights with those controllers. This, we believe, would 
still fulfil the requirements of Article 26 (GDPR). Either way we 
believe this paragraph needs more details and clarity. 





Q3 Does the draft code cover the right issues about data sharing? 
Yes 


[| No 


Q4 If no, what other issues would you like to be covered in it? 


Q5 Does the draft code contain the right level of detail? 
Yes 


[| No 


Q6 If no, in what areas should there be more detail within the draft 
code? 
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Q7 Has the draft code sufficiently addressed new areas or 
developments in data protection that are having an impact on your 
organisation's data sharing practices? 


Yes 


O No 


Q8__siIf no, please specify what areas are not being addressed, or not 
being addressed in enough detail 


Q9 Does the draft code provide enough clarity on good practice in data 
sharing? 


Yes 


O No 


Q10 If no, please indicate the section(s) of the draft code which could be 
improved, and what can be done to make the section(s) clearer. 


D 
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Q11 Does the draft code strike the right balance between recognising 
the benefits of sharing data and the need to protect it? 


Yes 


O No 


Q12 If no, in what way does the draft code fail to strike this balance? 


Q13 Does the draft code cover case studies or data sharing scenarios 
relevant to your organisation? 


Yes 
O No 


Q14 Please provide any further comments or suggestions you may have 
about the draft code. 


Ul 
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The proposed code was reviewed by a group if IG practitioners (see 
Q16) and overall it was felt that the code was clear and concise. It was 
also good to see that overall the code is not substantially different to 
the 2011 issued code. 


Specific elements of the proposed code that the group liked included: 
Page 11-13: Common misconceptions about data sharing 
Page 17: Real examples of data sharing activities. 
Page 26: Statement that an ISA does not provide a form of legal 
indemnity is clarity that this group welcomes. 
Page 70+ : Mergers and Acquisitions 
Page 77+ : Data Sharing and Children 


The group would like to request that the ICO include more 
examples/case studies, in relation to pp 58+59, specifically about: 
- Express statutory obligations 

- Express statutory powers 

- Implied statutory powers 





Q15 To what extent do you agree that the draft code is clear and easy 
O understand? 


cT 


Strongly agree 


L 

Agree 
O Neither agree nor disagree 
L Disagree 

O Strongly disagree 

Q16 Are you answering as: 


L] An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the public) 


L] An individual acting in a professional capacity 
O On behalf of an organisation 

Other 

Please specify the name of your organisation: 


This is a joint response submitted by the North Yorkshire Information 


Governance Practitioners Group (formed as under the Multi-Agency 
Information Sharing Protocol). The NY IGP group is made up of 
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practitioners representing local authorities, health bodies, emergency 
services, housing associations and other public sector organisations in 


the wider North Yorkshire area. 


www.northyorks.gov.uk/information-sharing 


Thank you for taking the time to share your views and experience. 





